[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#56821: [POSSIBLE GRAVE SECURITY HOLD]



Samuel Tardieu wrote:
> 
> Since apparently several Debian developers disagree on whether this issue
> is critical or not, I'd like to get input from other developers.
> 
>   [1] The default Debian installation installs a MBR in your disk's MBR and
>       installs lilo on your / partition.
> 
>   [2] Even if you setup your BIOS so that users can't boot from floppy disk
>       and if you secure lilo with a password, your system can still be booted
>       from a floppy:
>          - press shift at boot time, and Debian's MBR will give you a prompt
>            1FA:
>          - then press F, and your system will boot from floppy disk, and you
>            will get full root access to the hard disk

Err, there is a mistake here somewhere. If you are getting 1FA at the
boot
prompt then lilo is *NOT* in the MBR. If it were you would get the lilo
prompt.

If lilo is not installed in the MBR it still replaces the default MBR
with
another one to allow you to boot to either the DOS partition or lilo.

BTW, the reason you cite above is exactly the reason I always install
lilo in the MBR and and on another partition.

> Not fixing this in Potato and not issuing an advisory and a replacement mbr
> package for past distributions makes Debian a very weak distribution.
> 
> To take an analogy, what if your distribution installs a root shell freely
> available on virtual console F9 (so that it won't be easily noticed) without
> warning the system administrator by default?

OTOH, if you have physical access to the machine is there really any
security?

Martijn


Reply to: